Java exploit used in Red October cyberespionage attacks, researchers say

IDG News Service - The hundreds of government, military and research organizations targeted in a large-scale cyberespionage operation dubbed Red October were not only attacked using malicious Excel and Word documents as previously believed, but also by using Web-based Java exploits, according to researchers from Israeli IT security firm Seculert.

Researchers from antivirus vendors Kaspersky Lab published the results of their investigation into Red October on Monday. According to their report, the victims were targeted via rogue email messages that contained malicious documents designed to exploit known vulnerabilities in Microsoft Excel and Word.

Costin Raiu, director of Kaspersky's global research and analysis team, said Monday that other methods of distributing the cyberespionage malware might have been used, but hadn't been identified yet.

However, while analyzing the command and control servers used in the campaign, security researchers from Seculert discovered a special folder containing a malicious Java applet -- Web-based Java application -- designed to exploit a Java vulnerability patched in October 2011.

The exploit found on the server was compiled in Feb. 2012, which reinforces the belief that these attackers preferred to target older, known vulnerabilities, not zero-day -- previously unknown -- ones, the Seculert researchers said Tuesday in a blog post.

The discovery was made possible because at some point the attackers switched from using PHP as the server-side scripting language on their command and control servers to CGI. Some older PHP-based attack pages were still left on the servers and accessing them in a browser revealed their source code, the Seculert researchers said.

Evidence suggests that the Web-based attack method continued to be used even after switching the infrastructure to CGI, Aviv Raff, Seculert's chief technology officer, said Tuesday. However, it's not clear if exploits for newer vulnerabilities in Java or other browser plug-ins have been used in the past few months, he said.

Further analysis is impossible at this time because the command and control servers have been shut down, most likely by the attackers in an attempt to cover their tracks, Raff said.

The attackers tricked individuals in the targeted organizations into visiting the attack pages by sending them rogue emails with links pointing to them, the Seculert researchers said. It's not clear what those emails said, because no copy has been recovered yet, but they probably had a news-based theme, Raff said.

The attack pages, the Java exploit itself and even the URL for the malware payload contained strings referencing "news," Raff said. In fact, after the attack page loaded the Java exploit, the victims' browsers were being redirected to legitimate news sites, including one based in Turkey, he said.

Interestingly enough, command and control servers used in the Flame cyberespionage campaign also contained a "NewsForYou" string, suggesting that a news theme was used in those attacks. It's not clear at this time if this is just a coincidence or if there's a connection between the two campaigns, Raff said.

Raff believes that Red October is the work of a group of hackers trying to obtain high-value information which they can later sell to interested parties, rather than the result of a nation state's cyberespionage efforts. Researchers from Kaspersky Lab, who first uncovered this cyberespionage operation, favor the same theory.